Analysis
-
max time kernel
80s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 21:47
Static task
static1
General
-
Target
bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe
-
Size
703KB
-
MD5
a345fd93f2fba33b4684bcefa32a614e
-
SHA1
7b56bf6c2f279ade03196a8e8cc73ea60b79bc0c
-
SHA256
bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8
-
SHA512
7fdc92f9b85a595632983274ac32f9a5ee5d0bdcb9c71ad4c109156fb7a5ebc008429e9929c5bdc72b4997243d861fafb4e20357018fef21780ba2d5eb2a9dc5
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2560-122-0x0000000000E70000-0x0000000000E8C000-memory.dmp family_redline behavioral1/memory/2560-129-0x00000000027F0000-0x000000000280B000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
ipstersh.exepid process 2560 ipstersh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ipstersh.exepid process 2560 ipstersh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ipstersh.exedescription pid process Token: SeDebugPrivilege 2560 ipstersh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exedescription pid process target process PID 2044 wrote to memory of 2560 2044 bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe ipstersh.exe PID 2044 wrote to memory of 2560 2044 bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe ipstersh.exe PID 2044 wrote to memory of 2560 2044 bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe ipstersh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe"C:\Users\Admin\AppData\Local\Temp\bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wowsfree\ipstersh.exeipstersh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wowsfree\ipstersh.exeMD5
296e65b035542c1b2f2deefa32a88924
SHA16b5b6403475265eed348ba9a2b64f0e165e07679
SHA25683d6c0356008f91b0f7c742b05bb12a30f5da5289e14c49f3a6f0ffa8020bddf
SHA512fe45f292a5dd2cbbf89aa82e5d7d8e0a464004269ed0ee63fda6be2139d6604a1997d27d7083d60f324e8424f0dbade37317dd45be359535872363b564872669
-
C:\Users\Admin\AppData\Roaming\wowsfree\ipstersh.exeMD5
296e65b035542c1b2f2deefa32a88924
SHA16b5b6403475265eed348ba9a2b64f0e165e07679
SHA25683d6c0356008f91b0f7c742b05bb12a30f5da5289e14c49f3a6f0ffa8020bddf
SHA512fe45f292a5dd2cbbf89aa82e5d7d8e0a464004269ed0ee63fda6be2139d6604a1997d27d7083d60f324e8424f0dbade37317dd45be359535872363b564872669
-
memory/2044-117-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2044-116-0x0000000000DE0000-0x0000000000EAF000-memory.dmpFilesize
828KB
-
memory/2560-129-0x00000000027F0000-0x000000000280B000-memory.dmpFilesize
108KB
-
memory/2560-132-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/2560-124-0x0000000000400000-0x0000000000894000-memory.dmpFilesize
4.6MB
-
memory/2560-126-0x0000000000EA2000-0x0000000000EA3000-memory.dmpFilesize
4KB
-
memory/2560-125-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/2560-128-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/2560-127-0x0000000000EA3000-0x0000000000EA4000-memory.dmpFilesize
4KB
-
memory/2560-123-0x00000000009D0000-0x0000000000B1A000-memory.dmpFilesize
1.3MB
-
memory/2560-118-0x0000000000000000-mapping.dmp
-
memory/2560-130-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/2560-131-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/2560-122-0x0000000000E70000-0x0000000000E8C000-memory.dmpFilesize
112KB
-
memory/2560-133-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/2560-134-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/2560-135-0x0000000000EA4000-0x0000000000EA6000-memory.dmpFilesize
8KB
-
memory/2560-136-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/2560-137-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/2560-138-0x0000000006690000-0x0000000006691000-memory.dmpFilesize
4KB
-
memory/2560-139-0x0000000006880000-0x0000000006881000-memory.dmpFilesize
4KB
-
memory/2560-140-0x0000000006B70000-0x0000000006B71000-memory.dmpFilesize
4KB
-
memory/2560-141-0x0000000006D40000-0x0000000006D41000-memory.dmpFilesize
4KB